Can we store full PANs in our records?

Storing full PANs increases PCI scope and risk. Use tokenization or store only the last four digits unless you have documented PCI controls, documented scope, and compensating controls in place.

Is an electronic signature valid for PAN authorizations?

Yes. Electronic signatures meet U.S. legal standards under the ESIGN Act and UETA when intent, consent, attribution, and reproducible records are present; maintain audit trails demonstrating those elements.

What authentication level should signers use?

Use at minimum email or SMS verification for low-risk approvals and stronger authentication (MFA, KBA) for approvals that grant ongoing payment authority or expose PANs.

How do we handle a request to remove PAN data?

Define removal procedures that comply with state privacy laws; tokenize data prior to deletion and log the deletion event. Retain audit artifacts per legal retention rules.

When is notarization required for PAN documents?

Notarization is rarely required for payment records; use notaries only if a contract or state rule specifically demands a notarized authorization or when a third party requests notarized proof.

How do we correct errors on the PAN list?

Document corrections with a dated audit entry, re-verify the corrected data with the cardholder or processor, and capture approval signatures for the change.

Business PAN List

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS PAN LIST AND SERVICE AGREEMENT

Parties

Client Name: Client Address: Service Provider Name: Service Provider Address:

Recitals

WHEREAS, Client requires compilation, verification and secure delivery of a consolidated Business PAN list containing permanent account numbers, entity details and authorized signatory information for use in Client's compliance, vendor onboarding and recordkeeping processes;

WHEREAS, Service Provider has represented that it is experienced in collecting, validating and maintaining PAN and related business identity records and will provide such services pursuant to the terms of this Agreement;

WHEREAS, the Parties desire to set forth their respective rights and obligations with respect to the preparation, verification and delivery of the Business PAN List and the payment for such services.

Scope of Work

Service Provider shall perform the following services (collectively, the "Services"):

Detailed Scope:

Deliverables shall include a machine-readable Business PAN List in the format agreed between the Parties, a validation report describing verification steps undertaken, and a confidentiality and chain-of-custody statement for all received records.

Business PAN List

The Business PAN List shall contain the following minimum fields for each record: Registered Business Name, PAN, Entity Type, Registered Address, Authorized Signatory Name, Contact, and Verification Status. The Parties acknowledge that PAN entries constitute sensitive identity information and are subject to the confidentiality obligations below.

#	Registered Business Name	PAN	Entity Type	Authorized Signatory	Verification
1					Verified
2					Verified
3					Verified
4					Verified
5					Verified
6					Verified

Additional PAN records or attachments:

Payment Terms

In consideration for the Services, Client shall pay Service Provider the fees set forth below and in accordance with the following schedule.

Total Fee: Payment Schedule:

All payments are due within days of invoice. Late payments shall incur interest at a rate of or the maximum rate permitted by law, whichever is lower. Client shall be responsible for all reasonable costs of collection, including legal fees.

Term and Termination

This Agreement commences on and shall continue until unless earlier terminated as provided herein.

Either Party may terminate this Agreement for convenience upon days' prior written notice. Either Party may terminate immediately for material breach by the other Party if such breach is not cured within days after written notice. Termination shall not relieve Client of its obligation to pay for Services rendered and expenses incurred prior to termination.

Confidentiality

The Parties acknowledge that Business PAN information and associated identity data constitute sensitive and confidential information. Each Party (the "Receiving Party") shall: (a) hold all Confidential Information in strict confidence using at least the same degree of care it uses to protect its own confidential information but no less than reasonable care; (b) use Confidential Information only for the performance of obligations under this Agreement; and (c) not disclose Confidential Information to any third party except to employees, agents or contractors on a need-to-know basis who are bound by written confidentiality obligations at least as protective as those herein.

The obligations of confidentiality shall not apply to information that is: (i) or becomes publicly available other than by breach of this Agreement; (ii) rightfully known to the Receiving Party prior to disclosure; or (iii) independently developed without use of Confidential Information. Upon termination or at Client's request, Service Provider shall return or irretrievably destroy all Confidential Information and certify such destruction in writing.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to conflict of law principles. The Parties submit to the exclusive jurisdiction of the courts located in that State for resolution of disputes arising under this Agreement, subject to any agreement to the contrary in writing.

Representations; Certifications

Each Party represents and warrants that it has full power and authority to enter into this Agreement. Service Provider represents that it will perform Services in a professional manner consistent with industry standards. Client certifies that it has the right to provide the PAN records supplied to Service Provider, and that such provision does not violate third-party rights or applicable law.

Entire Agreement

This Agreement, together with any attachments and the Business PAN List delivered pursuant hereto, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, representations and understandings. Any amendment must be in writing and signed by both Parties.

Additional Notes / Special Terms:

Certification of Accuracy

By signing below, each Party certifies that the information it provided for inclusion in the Business PAN List is true, complete and accurate to the best of its knowledge and that it will promptly notify the other Party in writing of any errors or updates. Each Party acknowledges that inaccurate PAN data may result in regulatory or commercial consequences and agrees to cooperate in reasonable remediation efforts.

Client:

By:

Date:

Service Provider:

By:

Date:

What the Business PAN List Is and why it matters

A Business PAN List is a controlled register a company maintains of Primary Account Numbers (PANs) — the numeric identifiers on payment cards — and associated metadata for merchants, tokenization status, and authorization records. Because PANs are payment card data subject to PCI DSS, the list is treated as sensitive financial information; storage, access, and transmission require technical and administrative safeguards. In practice the list supports reconciliation, chargeback handling, vendor onboarding, and audit trails when paired with secure tokenization and documented consent processes.

Why a clear Business PAN List improves controls

A maintained PAN list centralizes payment identifiers, reduces reconciliation errors, and supports faster investigation of disputes while highlighting where PCI, privacy, and retention controls must apply.

Teams and roles that typically manage a Business PAN List

Practical ownership often spans finance, payments, and security teams who must collaborate on access, tokenization, and auditability.

Accounts Payable Manager — owns vendor onboarding, validates merchant account IDs and keeps reconciliation records aligned with bank statements.
Treasury / Payments Team — controls tokenization strategy, handles processor relationships, and configures chargeback monitoring and risk limits.
Security / Compliance Officer — enforces PCI scopes, documents encryption and retention controls, and coordinates audits and incident response.

Step-by-step: prepare and secure your Business PAN List

Follow a linear workflow to collect, verify, protect, and sign PAN entries so that operational and compliance teams can track changes.

01

Prepare List: Collect required fields and identify tokenization status.
02

Tokenize: Replace raw PANs with processor tokens when possible.
03

Verify: Confirm expiration and merchant identifiers with bank records.
04

Sign & Approve: Capture authorized signatures and record the approval timestamp.

How to configure an online Business PAN List workflow

Set up fields, authentication, retention, and integrations so digital completion reduces manual handling and preserves audit trails.

Field	Configuration
Required Fields	Lock Cardholder, Token, and Authorization Date
Authentication	Use multi-factor or SMS code for approvers
Data Storage	Store tokens in encrypted, access-controlled vaults
Integration	Connect to payment processor and accounting system

Technical and integration considerations

Choose a platform that supports secure transmission, token storage, and enterprise integrations for accounting and CRM.

Integrations: Salesforce, NetSuite, Google Workspace
Formats: PDF, DOCX, Excel import/export
Authentication: MFA, SMS code, KBA options

Where to send or file the Business PAN List entries

Decide final destinations and intermediary receptors for entries to support reconciliation, audits, and processor reconciliation.

Secure Vault: Encrypted token store for operational use
Payment Processor: Send tokens or authorized PANs if required
Accounting System: Post masked identifiers to ledger
Compliance Archive: Retain signed records for audit readiness

Typical timelines and response expectations

Set deadlines for collection, verification, audits, and retention to meet operational needs and regulatory expectations.

Account Change Updates:

Update PAN records within 30 days of change

Audit Response:

Provide requested artifacts within 10 business days

Retention Minimum:

Retain related financial records for at least 3 years

HIPAA Context:

Healthcare records kept 6 years when PHI involved

Annual Review:

Perform tokenization and access review yearly

Key milestones from collection to long-term retention

Track four sequential milestones so every PAN entry has a documented lifecycle and review cadence.

01

Collect

Gather required fields and initial consent

02

Authorize

Obtain merchant or cardholder authorization

03

Tokenize

Replace PAN with processor token

04

Archive Review

Annual access review and retention verification

Common mistakes to avoid when preparing a Business PAN List

Storing full PANs in spreadsheets without encryption or access controls exposes PCI scope and increases breach risk.
Transmitting PANs over unsecured email or chat leads to unauthorized disclosure and compliance violations.
Failing to tokenize or mask PANs complicates audits and prolongs forensic response after incidents.
Not recording authorization timestamps or signer identity weakens dispute resolution and increases liability.

Risks and compliance consequences of mishandling PAN data

PCI Noncompliance: Fines and increased monitoring

Chargebacks: Direct financial liability

Regulatory Action: State privacy enforcement

HIPAA Exposure: Fines if PHI also compromised

Reputational Harm: Customer loss and brand damage

Operational Disruption: Remediation and forensic costs

Security controls and standards to apply

In-Transit: TLS 1.2/1.3 required

At-Rest: AES-256 encryption recommended

Access Controls: Role-based least privilege

Audit Trail: Immutable timestamps and IP logs

Tokenization: Processor-issued tokens preferred

Certifications: PCI, SOC 2, ISO 27001

Core elements of a professional Business PAN List

Design the list so every entry supports verification, minimal storage, and a clear audit path linking authorization to payment events.

Unique Identifier

Assign an internal ID per record, reference last four digits and token to avoid storing full PAN and to speed reconciliations and lookups during dispute resolution.

Tokenization Status

Record whether a PAN is tokenized and the issuing processor token reference so operations use tokens rather than raw card numbers for recurring charges.

Authorization Evidence

Attach signed authorization records, timestamps, and the authentication method used so chargeback investigations have traceable consent proof.

Access Log

Maintain an immutable log of who accessed or exported PAN data, including timestamps and purpose, to support audits and incident response.

Retention & Disposal

Document retention period, secure destruction method, and who approved disposal once the record is no longer operationally needed.

Compliance Mapping

Map each field to applicable requirements (PCI, state privacy laws, HIPAA when relevant) so reviewers see why controls exist.

eSignature vendor pricing and compliance comparison

Compare starting prices, trial availability, bulk-send support, audit capabilities, HIPAA support, and envelope limits when selecting an eSignature vendor for PAN workflows.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	Yes, 7-day trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies	Varies	Varies

Real examples of PAN-related workflows in practice

Organizations use digitized PAN lists together with tokens and signed authorizations to speed billing and reduce manual reconciliation effort.

Optica Ventures LLC

Optica moved PAN tracking into a secure digital workflow to centralize vendor data and approvals.

They emphasized ease of use for customers and staff.
The change reduced manual reconciliation steps and preserved audit trails for investor billing and vendor payouts.

Tech Data

Tech Data integrated payment token references into its ledger to streamline collections.

The integration tied tokens to invoices.
This reduced chargeback investigations and improved speed to revenue while keeping sensitive card data out of general systems.

Frequently asked questions about Business PAN Lists

Answers to common operational and compliance questions about collecting, storing, and signing PAN-related records.

Need help? Contact support

Can we store full PANs in our records?
Storing full PANs increases PCI scope and risk. Use tokenization or store only the last four digits unless you have documented PCI controls, documented scope, and compensating controls in place.
Is an electronic signature valid for PAN authorizations?
Yes. Electronic signatures meet U.S. legal standards under the ESIGN Act and UETA when intent, consent, attribution, and reproducible records are present; maintain audit trails demonstrating those elements.
What authentication level should signers use?
Use at minimum email or SMS verification for low-risk approvals and stronger authentication (MFA, KBA) for approvals that grant ongoing payment authority or expose PANs.
How do we handle a request to remove PAN data?
Define removal procedures that comply with state privacy laws; tokenize data prior to deletion and log the deletion event. Retain audit artifacts per legal retention rules.
When is notarization required for PAN documents?
Notarization is rarely required for payment records; use notaries only if a contract or state rule specifically demands a notarized authorization or when a third party requests notarized proof.
How do we correct errors on the PAN list?
Document corrections with a dated audit entry, re-verify the corrected data with the cardholder or processor, and capture approval signatures for the change.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now